<p>I had the same issue a time or two. Running 'broctl ps.bro' right after 'broctl status' has become part of my new ritual before stopping/starting or just restarting any of my clusters. </p>
<p>Will</p>
<div class="gmail_quote">On Feb 17, 2012 12:08 PM, "Aashish Sharma" <<a href="mailto:asharma@lbl.gov">asharma@lbl.gov</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Yes. Incidently, I had same issue 3 days back. broctl analysis scan<br>
showed scan was disabled but cluster was still dropping host on scan.<br>
<br>
So I started looking at broctl status which said cluster not running<br>
while tail -f conn.log was growing.<br>
<br>
Ended up kill -s 9 on all bro worker nodes and restart with broctl.<br>
After which it has been fine. I was quite unusual.<br>
<br>
Aashish<br>
<br>
On Fri, Feb 17, 2012 at 12:00:28PM -0500, Seth Hall wrote:<br>
> Has anyone else ever had trouble with broctl getting confused about the status of a process? I just ran into it a little bit ago where broctl thought that all of my workers were dead when I tried to do a restart command. They failed when they were trying to start again because with the myricom sniffer drivers you can only sniff the interface once.<br>
><br>
> We need to do some debugging on this, but it happens sporadically enough that it might be tough. I sort of wonder if there are issues with broctl.dat being written, I've run into problems in that file before where things wouldn't be written right. Would it make sense to maybe even move away from broctl.dat (which tracks cluster state) and toward something like an SQLite database?<br>
><br>
> .Seth<br>
><br>
> --<br>
> Seth Hall<br>
> International Computer Science Institute<br>
> (Bro) because everyone has a network<br>
> <a href="http://www.bro-ids.org/" target="_blank">http://www.bro-ids.org/</a><br>
><br>
><br>
> _______________________________________________<br>
> bro-dev mailing list<br>
> <a href="mailto:bro-dev@bro-ids.org">bro-dev@bro-ids.org</a><br>
> <a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a><br>
<br>
--<br>
Aashish Sharma (<a href="mailto:asharma@lbl.gov">asharma@lbl.gov</a>)<br>
Cyber Security, Information Technology Division<br>
Lawrence Berkeley National Laboratory<br>
<a href="http://www.lbl.gov/cyber/pgp-aashish.txt" target="_blank">http://www.lbl.gov/cyber/pgp-aashish.txt</a><br>
Office: <a href="tel:%28510%29-495-2680" value="+15104952680">(510)-495-2680</a> Cell: <a href="tel:%28510%29-457-1525" value="+15104571525">(510)-457-1525</a><br>
<br>_______________________________________________<br>
bro-dev mailing list<br>
<a href="mailto:bro-dev@bro-ids.org">bro-dev@bro-ids.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a><br>
<br></blockquote></div>